Of all the digital threats that can affect a computer, rootkits deserve a special chapter. Their stealth and resistance to traditional cleanup methods make the average rootkit a formidable opponent—and the creativity of its developers only adds to the threat. In this case, we have Jellyfish, a proof-of-concept rootkit that can infect a computer's graphics system, improving both its camouflage and its performance.
The idea of infecting firmware is nothing new. Experts have explored this possibility for years, and the news about the NSA feasting on hard drives only confirms what we had suspected. Obviously, these are not 'simple' attack vectors, but the technical resources exist, and interest is growing. Those who are still skeptical need only visit GitHub to discover two new proof-of-concept projects. The first, which takes priority in our title, is called Jellyfish.
In simple terms, Jellyfish is a rootkit capable of infecting a computer's GPU and staying there even after the machine is turned off. Why would someone infect a GPU? In reality, there are quite good reasons.
Jellyfish: Infecting the GPU
Beyond remaining intact in the hardware, Jellyfish can spy on CPU memory via DMA, and take advantage of the GPU's resources for mathematical operations. As if that weren't enough, there is no analysis tool that can verify the presence of malicious code on a GPU. Until now, the malware variants that sought to extract something from the GPU did so with cryptocurrency mining in mind, but Jellyfish works at a deeper level. Its technical requirements include OpenCL drivers, and Nvidia or AMD hardware, with limited support for Intel chips with AMD's SDK. Jellyfish's development is not complete, and one of its future missions will be to incorporate a 'client listener', which will keep buffers stored on the GPU until the control server sends a packet to release them.
Demon: A Keylogger That Watches From the GPU
Demon is a keylogger inspired by a study that Columbia University published in 2013. The idea here is that Demon monitors the keyboard buffer from the GPU via DMA, without relying on classic 'hooks' or aggressive modifications to the kernel code. The creators of Demon and Jellyfish insist that they have no connection to the authors of the Columbia study, and to be honest, they don't need one to cause a stir. A GPU spying on and recording everything we type? In my book, that's a nightmare.
On the other hand, there is the IOMMU (input/output memory management unit) function, which among other things protects memory from strange DMA actions, although it is not present on all hardware. Implementing an attack based on Jellyfish is probably very difficult, however... the code is on GitHub.
